In brief
- Advanced AI models are increasingly being leveraged to detect security flaws in software.
- Claude Mythos, Claude Opus, GPT-5.5, and similar systems have been applied in vulnerability research spanning web browsers, operating systems, and open-source projects.
- This trend is starting to reshape crypto and DeFi security, with Claude Opus 4.8 playing a key role in research that exposed a serious flaw in Zcash.
The newest wave of advanced AI models has moved well beyond chatting with users, creating images, or writing code. Researchers are now turning to systems like Anthropic’s Claude Mythos and Claude Opus 4.8, along with OpenAI’s GPT-5.5, to uncover software vulnerabilities—sparking concerns about what happens as these powerful tools become more widely accessible.
Crypto investors received a stark reminder of the growing risk posed by advanced AI this week when Zcash developers revealed that Claude Opus 4.8 helped uncover a critical flaw that could have allowed an attacker to create unlimited ZEC tokens. Because of how the network is built, there’s no definitive way to determine whether counterfeit ZEC was actually produced—and that uncertainty triggered a sharp drop in ZEC’s price late in the week.
Experts caution that many additional vulnerabilities are likely to surface in the coming weeks and months as AI tools grow more sophisticated and easier to access. Here’s a closer look at the escalating threat and how it has already affected the crypto landscape.
In their early days, AI models were primarily used as coding assistants—helping developers write, interpret, and troubleshoot software. As the technology matured, researchers began applying the same systems to code review, software auditing, and vulnerability analysis.
The shift from coding helper to security tool mirrored a broader transformation in how AI was being integrated into software development. Following the 2025 launch of Claude Code, Anthropic reported a dramatic rise in AI-generated code within its engineering teams, marking a transition from models that merely suggested code to systems that could write and execute it independently.
Security experts say the implications go far beyond simply helping developers write better code.
“AI is far more effective at reviewing code than most people and spotting potential vulnerabilities in it,” said Danny Jenkins, CEO and co-founder of ThreatLocker, in an interview with Decrypt. Jenkins noted that current AI systems are already speeding up the discovery of vulnerabilities, and that newer models like Mythos could dramatically expand those abilities, calling it an approaching “big problem.”
“It’s only a matter of time before someone with bad intentions gains access to it,” he added.
According to Jenkins, AI is also making vulnerability research more accessible, enabling more people to examine code, pinpoint weaknesses, and craft exploits. As access to increasingly powerful systems broadens, he anticipates the rate of vulnerability discovery will accelerate.
“Before AI, cybersecurity threats and exploits were growing every year,” he said. “After AI, the pace has picked up even more, and I believe there are two main reasons. First, AI can now assist in finding vulnerabilities and exploits, and second, the number of people capable of doing this has exploded. You no longer need to be a script kiddie.”
As AI systems have grown more powerful, companies have started deploying them for cybersecurity purposes. On Tuesday, Anthropic broadened access to Project Glasswing, granting 150 companies and institutions the ability to use Claude Mythos to help detect and fix software vulnerabilities before the model is released more widely.
In April, Mozilla disclosed that Anthropic’s models helped uncover hundreds of vulnerabilities that it patched in the Firefox web browser, while researchers at Calif used Mythos Preview in work that produced one of the first public exploits targeting Apple’s M5 chips.
Stanislav Fort, a former researcher at Google DeepMind and Anthropic who is now founder and chief scientist at security firm Aisle, said concerns about AI-driven vulnerability discovery are legitimate but frequently mischaracterized.
“The instinctive reaction is to try to restrict access to powerful models. I think this amounts to security through obscurity, and security through obscurity is one of the worst approaches in the field,” Fort told Decrypt. “The ability to discover zero-day vulnerabilities is already widely available across models that no one can control. Trying to contain it is futile.”
It’s worth noting that relying solely at the cutting edge doesn’t truly eliminate the risks; it simply postpones them while additionally slowing down the defenders who rely on these tools the most.
Fort emphasized that the greater danger lies in the fact that defenders, especially those maintaining open-source projects, may not have the same access to advanced AI tools that attackers possess.
“That imbalance represents the genuine threat,” he stated. “Limiting access isn’t the solution; making defensive tools widely available is.”
Anthropic isn’t the only company championing AI models for cybersecurity. Back in May, Microsoft unveiled MDASH, an agentic vulnerability discovery system which the company claims contributed to identifying previously unknown Windows vulnerabilities.
Cryptocurrency and DeFi are now starting to experience the effects of AI-driven bug hunting. Blockchain projects have always drawn attackers due to the significant amounts of money involved and the public nature of much of the codebase. Jenkins explained that as AI becomes more adept at detecting software vulnerabilities, open-source crypto projects may become increasingly vulnerable to both security researchers searching for weaknesses and attackers seeking to exploit them.
In one of the most striking demonstrations of how advanced AI models can help researchers unearth vulnerabilities that had escaped detection during years of human code review, independent security researcher Taylor Hornby revealed a critical flaw in Zcash’s Orchard privacy pool, discovered with the help of Claude Opus 4.8.
The vulnerability could have permitted an attacker to mint unlimited counterfeit ZEC and had remained undetected for years prior to being addressed. Whether this exploit was actually leveraged remains a mystery at this time.
“The vulnerability existed from Orchard’s activation in May 2022 until the emergency patch was rolled out on June 1, 2026,” Shielded Labs, the organization responsible for Zcash development, disclosed in their public report. “Because of the privacy features of Orchard and the nature of the flaw, there is no cryptographic way to definitively determine whether any exploitation took place.”
This incident comes at a time when DeFi protocols are facing one of their worst years in terms of attack activity. More than $840 million was siphoned from DeFi projects in the initial five months of 2026, including over $600 million in a single month — April — through breaches of projects such as KelpDAO and Drift Protocol.
The emergence of so-called “vibe hacking”, where attackers harness AI coding agents to automate reconnaissance, credential theft, malware creation, and other activities, has sparked growing concern that AI is lowering the entry barrier to executing sophisticated cyberattacks.
According to Natalie Newson, senior blockchain investigator at Web3 security platform CertiK, while the severity of exploits in April was unusual, the broader trend has remained relatively stable and still sits below the peak number of incidents recorded in previous years.
“April 2026 was a particularly grim month for crypto exploits; there were only three days in which no exploit involving at least $10,000 occurred,” she said. “That said, when we assess the overall landscape, the number of incidents (not counting phishing) has been fairly steady and remains lower than the peak seen in 2023.”
While AI is making DeFi exploits easier to execute, Blockaid CTO Raz Niv believes the bigger concern isn’t AI replacing human hackers but rather enhancing them — enabling attackers to concentrate on more advanced techniques while the AI takes care of routine operational tasks.
“The encouraging news is that defenders can leverage the same tools,” he noted. “AI-powered monitoring and simulation are becoming indispensable for security teams striving to stay ahead of threats.”
